DecisionHub Data Processing Addendum

Version 1.0 · Effective 2026-10-01

This Data Processing Addendum ("DPA") forms part of the Agreement between DecisionHub Limited, a corporation incorporated under the Canada Business Corporations Act (Corporation No. 1289917-5) with its registered office in Calgary, Alberta ("DecisionHub"), and the Customer named in the Order Form.

1. Purpose, structure and precedence

1.1 Purpose. This DPA sets out how DecisionHub handles and protects Customer Data, and how it supports the Customer in meeting its privacy and access-to-information obligations.

1.2 Agreement. The "Agreement" means the Order Form, the DecisionHub Terms of Service, the DecisionHub Service Level Agreement and this DPA, each in the version in effect on the Order Form date.

1.3 Precedence. If there is a conflict, the following order applies, highest first:

• 1.Applicable Privacy Law.
• 2.Any privacy schedule the Customer attaches to the Order Form and DecisionHub accepts.
• 3.The Order Form, including any Special Terms.
• 4.This DPA, on any matter involving Customer Data or Personal Information.
• 5.The Service Level Agreement, on service levels and credits.
• 6.The Terms of Service.

1.4 Duration. This DPA applies for as long as DecisionHub holds any Customer Data.

2. Definitions

Capitalized terms not defined here have the meaning given in the Terms of Service.

• •Aggregated Data means data derived from Customer Data or Usage Data that has been (a) anonymized, in accordance with generally accepted practices, so that no individual can be identified directly or indirectly, and (b) combined with data from other sources or customers so that it does not identify the Customer or any applicant organization.
• •Applicable Privacy Law means all privacy, data protection and access-to-information laws in Canada that apply to the Personal Information processed under the Agreement, as amended or replaced from time to time.
• •Customer Data means all data submitted to or created in the Services by or for the Customer, including applications, attachments, reviews, scores, notes, decisions, reports and activity logs. Customer Data does not include Usage Data or Aggregated Data.
• •Personal Information means information about an identifiable individual, as defined in Applicable Privacy Law.
• •Security Incident means a breach of DecisionHub's security safeguards, or those of its Sub-processors, that results in, or that DecisionHub reasonably believes has resulted in, unauthorized access to, or disclosure, loss, alteration or destruction of, Customer Data.
• •Sub-processor means a third party engaged by DecisionHub that processes Customer Data to provide the Services.
• •Usage Data means information about how the Services are accessed and used (such as feature usage, performance, error and configuration data), excluding the content of applications, attachments, reviews and other Customer Data.

3. Roles, ownership and use of data

3.1 Ownership. As between the parties, the Customer owns all Customer Data. DecisionHub claims no ownership of Customer Data.

3.2 Roles. DecisionHub processes Customer Data on the Customer's behalf, as its service provider, and only as permitted by the Agreement. The Customer retains control of Customer Data, including for access-to-information purposes. DecisionHub has custody only.

3.3 Licence. The Customer grants DecisionHub a limited, non-exclusive, non-transferable licence to host, process, transmit, display and back up Customer Data to provide, maintain, secure, support and improve the Services. DecisionHub will not disclose Customer Data to any third party or other customer in doing so, except to Sub-processors engaged under section 8.

3.4 Usage Data and Aggregated Data. DecisionHub may collect Usage Data and create Aggregated Data, and may use both during and after the term to operate, improve and develop its products and services. DecisionHub owns Usage Data and Aggregated Data. DecisionHub will not attempt to re-identify Aggregated Data, and will publish Aggregated Data only in a form that does not identify the Customer, any individual or any applicant organization.

3.5 No withholding. DecisionHub will not withhold Customer Data from the Customer, including because of a fee dispute or any other dispute, except where required by law or court order.

3.6 Restoration. If Customer Data is lost or corrupted, DecisionHub will use commercially reasonable efforts to restore it from its most recent backup. Where the loss was caused by DecisionHub's breach of the Agreement, the restoration is at DecisionHub's cost.

4. Instructions and purpose limits

4.1 Instructions. DecisionHub processes Customer Data on the Customer's instructions, except as permitted by section 3 or required by law. Instructions include the Agreement, the Customer's configuration and use of the Services, and the Customer's reasonable written requests.

4.2 Prohibited uses. DecisionHub will not sell or rent Customer Data, use it for third-party advertising, or use it other than as permitted by the Agreement.

4.3 Unlawful instructions. DecisionHub will tell the Customer if it becomes aware that an instruction would breach Applicable Privacy Law, and is not required to follow that instruction.

4.4 Customer responsibilities. The Customer is responsible for having lawful authority to collect the Personal Information it gathers through the Services, for providing any required collection notices, and for the content of its forms.

5. Data location and international transfers

5.1 Primary hosting. DecisionHub stores Customer Data in its primary database in Canada, hosted by MongoDB Atlas on Amazon Web Services in the Canada West (Calgary) region, including database backups. Google Cloud services used for application hosting, file storage, sign-in and email delivery are being moved to a Canadian region, with completion scheduled by January 1, 2027. Until that migration is complete, those services may process Customer Data in North America, as identified in Schedule 2. AI features use the separate Sub-processor identified in Schedule 2.

5.2 Sub-processor locations. Schedule 2 identifies each Sub-processor, the categories of Customer Data it processes and its processing location. DecisionHub will not permit any Sub-processor to process Customer Data outside Canada except as disclosed in Schedule 2 or approved by the Customer.

5.3 Usage Data. Usage Data may be processed outside Canada by the Sub-processors identified in Schedule 2. DecisionHub configures its analytics and monitoring tools to exclude Customer Data content, including form inputs, application text and attachments.

5.4 Transfer safeguards. Where Customer Data is processed outside Canada, DecisionHub will:

(a) limit the data transferred to what is reasonably necessary for the relevant function;

(b) use Sub-processors that encrypt data in transit and at rest; and

(c) bind the Sub-processor by written contract to data protection obligations substantially similar to those in this DPA.

5.5 Personnel access. DecisionHub personnel access Customer Data from Canada only, through DecisionHub's secured access controls, and only to the extent necessary to provide, support, maintain or recover the Services.

5.6 Government and legal demands. If DecisionHub receives a demand from a court, government or law-enforcement authority, whether Canadian or foreign, to disclose Customer Data, DecisionHub will:

(a) redirect the authority to the Customer where possible;

(b) notify the Customer promptly before any disclosure, unless prohibited by law;

(c) use reasonable efforts to challenge any demand it reasonably believes to be invalid or overbroad; and

(d) disclose only the minimum Customer Data legally required.

6. Security

6.1 Safeguards. DecisionHub maintains reasonable administrative, technical and physical safeguards, appropriate to the sensitivity of the data, to protect Customer Data against unauthorized access, use, disclosure, alteration and destruction. These include the measures described in Schedule 1.

6.2 No reduction. DecisionHub will not materially reduce the overall level of security of the Services during the term.

6.3 Separation. DecisionHub keeps each customer's Customer Data separate and secure from the data of its other customers.

7. Personnel

7.1 Need to know. DecisionHub limits access to Customer Data to personnel who need it for their role.

7.2 Confidentiality. Personnel with access to Customer Data are bound by confidentiality obligations and are informed of their privacy and security responsibilities.

7.3 Removal of access. DecisionHub removes access promptly when a person leaves DecisionHub or no longer needs it.

8. Sub-processors

8.1 Current list. DecisionHub's current Sub-processors are listed in Schedule 2. The Customer authorizes DecisionHub to use them.

8.2 Changes. DecisionHub will notify the Customer at least 30 days before a new Sub-processor begins processing Customer Data. If the Customer reasonably objects on privacy or security grounds, the parties will discuss the objection in good faith. If it is not resolved, the Customer may terminate the affected Services and receive a pro-rated refund of prepaid fees for them, as its sole remedy.

8.3 Obligations. DecisionHub binds each Sub-processor in writing to data protection obligations substantially similar to those in this DPA, and remains responsible for its Sub-processors' performance of those obligations.

9. Security incidents

9.1 Notice. DecisionHub will notify the Customer without undue delay and in any event within 48 hours after becoming aware of a Security Incident, by email to the contact named in Schedule 4.

9.2 Information. To the extent known, and as it becomes available, DecisionHub will provide:

• •a description of the incident and when it occurred;
• •the categories of Customer Data and individuals affected;
• •the steps taken to contain it; and
• •a DecisionHub contact.

9.3 Response. DecisionHub will take reasonable steps to contain the incident and reduce its effects, and will keep the Customer reasonably informed until it is resolved.

9.4 Customer controls notification. DecisionHub will not notify affected individuals, regulators or the public about a Security Incident involving Customer Data without the Customer's approval, unless the law requires it.

9.5 Cooperation. DecisionHub will provide reasonable assistance to help the Customer investigate the incident and meet its own notification and reporting obligations.

9.6 Records. DecisionHub keeps records of Security Incidents as required by Applicable Privacy Law.

10. Access requests and corrections

10.1 Requests to DecisionHub. If DecisionHub receives a request from an individual or third party for access to, or correction of, Customer Data, it will promptly redirect the requester to the Customer and will not respond to the request itself, unless required by law.

10.2 Assistance. The Services allow the Customer to search, export and correct Customer Data, so that it can respond to access and correction requests. Where the Customer can't do so through the Services, DecisionHub will provide reasonable assistance within a reasonable time on the Customer's written request.

11. Assessments and assurance

11.1 Information. DecisionHub will provide reasonable information about the Services, such as its standard privacy and security documentation, to support the Customer's privacy impact assessments and security reviews. DecisionHub will respond to one reasonable security questionnaire each year at no charge.

11.2 Confirmation of compliance. On the Customer's reasonable written request, no more than once a year, DecisionHub will confirm in writing whether it is complying with this DPA.

11.3 Audit. The information in sections 11.1 and 11.2 is intended to satisfy the Customer's audit needs. Where a further audit is required by law or a regulator, or follows a Security Incident caused by DecisionHub, the Customer or an independent auditor bound by confidentiality may audit DecisionHub's compliance with this DPA. The audit must be on at least 30 days' notice, during business hours, and at the Customer's cost.

11.4 Regulators. DecisionHub will cooperate with any investigation or order of a privacy regulator relating to Customer Data, as required by law.

11.5 Notice of non-compliance. DecisionHub will tell the Customer promptly if it determines that it can no longer meet its obligations under this DPA.

12. AI features

12.1 No training. DecisionHub will not use Customer Data, and will not permit its AI providers to use Customer Data, to train AI or machine-learning models.

12.2 AI form building. The Services use AI to help build forms from documents uploaded for that purpose, such as blank application forms and program guidelines. These documents and the resulting form content are processed by the AI providers listed in Schedule 2. Applicant submissions and other user data are not sent to AI providers.

12.3 Other AI features. DecisionHub does not currently offer AI features that process applicant submissions or other user data. If DecisionHub introduces such features, they will be off by default and enabled only by a Customer administrator, will process only the Customer Data needed for the feature, and will use AI providers added to Schedule 2 under section 8.

13. Retention, return and deletion

13.1 Retention during the term. DecisionHub retains Customer Data for the term of the Agreement, including renewals, and does not delete or alter Customer Data except as directed by the Customer or as described in this section and Schedule 1. The Customer may delete Customer Data through the Services or by written instruction to DecisionHub.

13.2 Customer's retention obligations. The Customer is responsible for determining how long Customer Data is retained to meet its legal obligations, including any requirement to retain Personal Information used to make a decision about an individual, and any legal or access-to-information hold. DecisionHub will suspend deletion of specified Customer Data on the Customer's written request.

13.3 Export. The Customer may export its Customer Data during the term in commonly used formats, including CSV, PDF and attachments in their original format.

13.4 End of term. After the term ends:

• 1.the Customer has 30 days to export its Customer Data, and DecisionHub will provide reasonable help with the export on request;
• 2.DecisionHub deletes the Customer Data from its active systems within 60 days after the term ends, and from backups as they expire in their normal 35-day cycle and in all cases within 12 months after the term ends; and
• 3.on request, DecisionHub confirms the deletion in writing.

13.5 Retention required by law. DecisionHub may keep Customer Data where the law requires it to. This DPA continues to apply to that data until it is deleted.

14. Liability

14.1 Each party's liability arising out of or related to this DPA is subject to the exclusions and limitations of liability in the Terms of Service, and counts toward the aggregate limit set out there.

15. Changes and termination

15.1 Schedules. DecisionHub may update Schedules 1 and 2 under sections 6 and 8, but not in a way that materially reduces the protection of Customer Data.

15.2 Other changes. Any other change to this DPA applies to the Customer only at renewal, or with the Customer's written agreement.

15.3 Termination. The Customer may terminate the Agreement for a material breach of this DPA that DecisionHub doesn't cure within 30 days of notice.

15.4 Survival. Sections 3, 5, 9, 10, 13 and 14 survive termination for as long as DecisionHub holds any Customer Data. Governing law and other general terms are set out in the Terms of Service.

Schedule 1: Security Measures

Schedule 2: Sub-processors

Current as of October 1, 2026

Schedule 3: Processing Details

Individuals: applicants and their contacts; reviewers and committee members; Customer staff; grantees.

Data:

• •contact and organization details
• •applications and attachments
• •financial information, such as budgets, financial statements, receipts and invoices
• •banking and payee details, where the Customer collects them
• •demographic data, if the Customer collects it
• •reviews, scores, decisions and conflict-of-interest declarations
• •signatures and agreement acceptances
• •award amounts and payment status
• •photos and stories submitted with consent
• •activity logs.

Purpose: running the Customer's grant-making programs: intake, review, decision, agreements, payment tracking and reporting.

Duration: the term, plus the periods in section 13.

Schedule 4: Contacts

Schedule 5: Public-Sector Riders

These riders apply only where the Customer is a public body in the jurisdiction named.

Alberta public bodies (Protection of Privacy Act; Access to Information Act): the Customer retains control of the records. DecisionHub will provide reasonable assistance with the Customer's access requests, corrections and privacy impact assessments, and with its reporting of Security Incidents to the Information and Privacy Commissioner of Alberta.

British Columbia public bodies (Freedom of Information and Protection of Privacy Act): DecisionHub acknowledges it is a service provider to the public body under that Act. DecisionHub will notify the Customer without undue delay of any unauthorized disclosure of Personal Information it becomes aware of and will provide the information the Customer needs for its privacy impact assessment, including on disclosures outside Canada.

Ontario institutions (Municipal Freedom of Information and Protection of Privacy Act or Freedom of Information and Protection of Privacy Act): the institution retains control of the records. DecisionHub will make records available to the institution for access requests and orders of the Information and Privacy Commissioner of Ontario and will provide reasonable assistance with the institution's privacy impact assessments and breach reporting, including requirements in force from January 1, 2027.